Use this when building or reviewing privileged automation around Memberships plans, user memberships, and per-post content restriction rules through the WordPress Abilities API.
\n\n\n\"Memberships abilities are customer-facing REST endpoints for headless member dashboards.\"
\n
They are privileged Abilities API operations. Plan and user-membership abilities check manage_woocommerce. The 1.29.0 post-restriction abilities check manage_woocommerce_membership_plans; the GET ability also reaches the trait's numeric edit_post check because its input is the post ID. The UPDATE ability input is an object/array, so add your own edit_post guard when wrapping it. Use these abilities for admin/editor/agent automation, not untrusted frontend flows.
Trigger when ANY of the following is true:
\nwp_register_ability(), wp_get_ability(), wp_abilities_api_init, or agent automation for Memberships.woocommerce-memberships/./wc-memberships/v1/post-restriction-rules/{id} or uses the block editor Memberships sidebar restriction entity.Memberships 1.28.0+ implements the SkyVerge framework HasAbilitiesContract in WC_Memberships. The framework initializes ability registration only when WordPress exposes both:
function_exists( 'wp_register_ability' )\nfunction_exists( 'wp_register_ability_category' )\nOn supported WordPress versions, the framework hooks:
\n| Hook | \nPurpose | \n
|---|---|
wp_abilities_api_categories_init | \nRegisters Memberships ability categories. | \n
wp_abilities_api_init | \nRegisters the abilities. | \n
rest_api_init | \nRegisters framework REST routes only for abilities with explicit RestConfig. In 1.29.0 this applies to the post-restriction rule GET/PUT abilities. | \n
Do not assume these abilities exist on older WordPress installs. In WP 7.0+ contexts, they should be available if Memberships is loaded and no site-level code disables the Abilities API.
\n| Category slug | \nMeaning | \n
|---|---|
woocommerce-membership-plans | \nAbilities related to WC_Memberships_Membership_Plan. | \n
woocommerce-user-memberships | \nAbilities related to WC_Memberships_User_Membership. | \n
woocommerce-memberships-posts | \nAbilities related to per-post membership restriction configuration. | \n
| Ability | \nClass | \nPermission | \nAnnotation | \nInput | \n
|---|---|---|---|---|
woocommerce-memberships/plans-create | \nCreatePlan | \nmanage_woocommerce | \nwrite, non-destructive, non-idempotent | \nPlan object data. | \n
woocommerce-memberships/plans-delete | \nDeletePlan | \nmanage_woocommerce | \ndestructive | \nInteger plan ID. | \n
woocommerce-memberships/plans-get | \nGetPlan | \nmanage_woocommerce | \nreadonly, idempotent | \nInteger plan ID. | \n
woocommerce-memberships/plans-list | \nListPlans | \nmanage_woocommerce | \nreadonly, idempotent | \nWP_Query-like args for plans. | \n
woocommerce-memberships/user-memberships-create | \nCreateUserMembership | \nmanage_woocommerce | \nwrite, non-destructive, non-idempotent | \nplan_id, user_id, optional product_id, order_id. | \n
woocommerce-memberships/user-memberships-delete | \nDeleteUserMembership | \nmanage_woocommerce | \ndestructive | \nInteger user membership ID. | \n
woocommerce-memberships/user-memberships-get | \nGetUserMembership | \nmanage_woocommerce | \nreadonly, idempotent | \nInteger user membership ID. | \n
woocommerce-memberships/user-memberships-list | \nListUserMemberships | \nmanage_woocommerce | \nreadonly, idempotent | \nuser_id, optional status. | \n
woocommerce-memberships/post-restriction-rules-get | \nGetPostRestrictionRules | \nmanage_woocommerce_membership_plans plus edit_post for direct integer input | \nreadonly, idempotent | \nInteger post ID. | \n
woocommerce-memberships/post-restriction-rules-update | \nUpdatePostRestrictionRules | \nmanage_woocommerce_membership_plans in source; add edit_post in wrappers | \nwrite, non-destructive, idempotent | \nObject with id and replacement rules. | \n
Output schemas use the plugin object JSON schemas:
\nWC_Memberships_Membership_Plan::getJsonSchema()WC_Memberships_User_Membership::getJsonSchema()PostRestrictionRulesSerializer::getJsonSchema()plans-create delegates to wc_memberships()->get_plans_instance()->createPlan( $data ).
Important input groups:
\n| Input | \nNotes | \n
|---|---|
name | \nRequired by schema. | \n
slug | \nOptional plan slug. | \n
status | \ndraft or publish. | \n
description | \nOptional description. | \n
access.method | \nmanual-only, signup, or purchase. | \n
access.product_ids | \nRequired by business rules when method is purchase. | \n
membership_length.type | \nunlimited, specific, or fixed. | \n
membership_length.amount / period | \nRequired by business rules for specific. | \n
membership_length.start_date / end_date | \nRequired by business rules for fixed. | \n
rules.content_restriction | \nPlan content restriction rules. | \n
rules.product_restriction | \nProduct view/purchase restriction rules. | \n
rules.purchasing_discount | \nMember discount rules. | \n
Do not write the wc_memberships_rules option directly when an ability or plan API can create the plan and rules together.
user-memberships-create delegates to Memberships's user membership manager:
wc_memberships()->get_user_memberships_instance()->create_user_membership( $data );\nSchema fields:
\n| Input | \nNotes | \n
|---|---|
plan_id | \nRequired membership plan ID. | \n
user_id | \nRequired WP user ID. | \n
product_id | \nOptional product that granted access. | \n
order_id | \nOptional order that granted access. | \n
For purchase-based access, prefer passing meaningful product_id and order_id when the membership is truly tied to a purchase. Do not fake order/product relations just to satisfy reporting.
Memberships 1.29.0 added Abilities API operations for the block-editor Memberships sidebar. They are configuration APIs for restrictable posts, not runtime access checks.
\n| Need | \nAbility | \nREST route | \n
|---|---|---|
| Read rules applying to a post | \nwoocommerce-memberships/post-restriction-rules-get | \nGET /wc-memberships/v1/post-restriction-rules/{id} | \n
| Replace post-specific rules | \nwoocommerce-memberships/post-restriction-rules-update | \nPUT /wc-memberships/v1/post-restriction-rules/{id} | \n
post-restriction-rules-get returns:
array(\n 'id' => 123,\n 'rules' => array(\n array(\n 'id' => 'rule-id',\n 'membership_plan_id' => 456,\n 'access_schedule' => array( 'type' => 'immediate' ),\n 'editable' => true,\n ),\n ),\n);\nThe response includes both post-specific rules and inherited rules from post-type/taxonomy level configuration. The editable flag is the safety boundary:
editable === true: rule targets this post directly and can be sent to the update ability.editable === false: inherited rule; render read-only and edit it on the membership plan/source rule, not from the post payload.post-restriction-rules-update treats rules as the full desired state for post-specific content restriction rules:
id are updated.id are added.rules: array() clears all direct post-specific rules.422 invalid_input because the ID does not belong to this post.Safe PHP execution shape:
\n$get = wp_get_ability( 'woocommerce-memberships/post-restriction-rules-get' );\n$current = $get ? $get->execute( $post_id ) : null;\n\nif ( is_wp_error( $current ) || ! is_array( $current ) ) {\n return $current;\n}\n\n$editable_rules = array_values( array_filter(\n $current['rules'],\n static fn( array $rule ): bool => ! empty( $rule['editable'] )\n) );\n\n$editable_rules[] = array(\n 'membership_plan_id' => $plan_id,\n 'access_schedule' => array( 'type' => 'delayed', 'amount' => 7, 'period' => 'days' ),\n);\n\nif ( ! current_user_can( 'edit_post', $post_id ) ) {\n return new WP_Error( 'forbidden', 'Cannot edit this post.', array( 'status' => 403 ) );\n}\n\n$update = wp_get_ability( 'woocommerce-memberships/post-restriction-rules-update' );\n$result = $update ? $update->execute( array(\n 'id' => $post_id,\n 'rules' => $editable_rules,\n) ) : new WP_Error( 'missing_ability' );\nThe update rule schema accepts membership_plan_id and optional access_schedule. Delayed schedules use type = delayed, positive amount, and period in days, weeks, months, or years; immediate schedules use array( 'type' => 'immediate' ).
The block editor sidebar also registers REST-exposed post meta for _wc_memberships_force_public and the per-post custom restriction message keys. Those meta writes are separate from rule replacement; use the abilities above for rule rows and normal post meta/REST for the sidebar's force-public/message settings.
$ability = function_exists( 'wp_get_ability' )\n ? wp_get_ability( 'woocommerce-memberships/user-memberships-get' )\n : null;\n\nif ( ! $ability || ! current_user_can( 'manage_woocommerce' ) ) {\n return new WP_Error( 'forbidden', 'Membership ability is unavailable.', array( 'status' => 403 ) );\n}\n\n$result = $ability->execute( 123 );\n\nif ( is_wp_error( $result ) ) {\n return $result;\n}\nLet the ability permission callback run; the explicit current_user_can() guard is useful when your code is about to choose between an admin path and a frontend-safe path.
| Need | \nPrefer | \n
|---|---|
| Admin/agent automation on WP 7.0+ | \nAbilities API. | \n
| External integration over HTTP with Woo auth | \nMemberships REST API. | \n
| In-process plugin business logic | \nPublic PHP APIs and objects. | \n
| Customer frontend/headless \"my memberships\" | \nCustom endpoint that checks ownership and uses Memberships access APIs. | \n
| Public member directory | \n/wc/v4/memberships/members/directory, with page/block validation and privacy-limited fields. | \n
| Block-editor per-post restriction UI | \npost-restriction-rules-get/update abilities or their /wc-memberships/v1/post-restriction-rules/{id} routes. | \n
Do not use manage_woocommerce abilities for a customer-facing dashboard. A customer should not be able to list arbitrary users' memberships or delete plans.
plans-list; even though the ability is admin-gated, sanitize UI inputs before execution.showInRest = true for Abilities API metadata but do not provide the SkyVerge framework RestConfig; the post restriction rule abilities do.editable === true and intentionally rebuild the direct post-specific rule set.WP_Ability::execute() passes validated input to the permission callback, but the update input is an array, not a numeric ID, so the shared trait's edit_post branch does not fire there in 1.29.0. Add an explicit current_user_can( 'edit_post', $post_id ) check before custom update wrappers.// WRONG: exposing a privileged ability to any logged-in user.\nregister_rest_route( 'my/v1', '/membership', array(\n 'methods' => 'POST',\n 'permission_callback' => 'is_user_logged_in',\n 'callback' => function ( WP_REST_Request $request ) {\n return wp_get_ability( 'woocommerce-memberships/user-memberships-delete' )->execute( (int) $request['id'] );\n },\n) );\n\n// RIGHT: use capability checks for privileged automation.\nregister_rest_route( 'my/v1', '/admin/membership', array(\n 'methods' => 'POST',\n 'permission_callback' => static fn() => current_user_can( 'manage_woocommerce' ),\n 'callback' => function ( WP_REST_Request $request ) {\n $ability = wp_get_ability( 'woocommerce-memberships/user-memberships-get' );\n return $ability ? $ability->execute( (int) $request['id'] ) : new WP_Error( 'missing_ability' );\n },\n) );\nwcm-membership-hooks for lifecycle hooks, REST/webhooks, profile fields, member directory, CSV, and Subscriptions-linked memberships.wcm-data-model-subscriptions-link for CPT names, meta keys, rule storage, and Subscriptions relation storage.wcm-access-discounts for access checks, restriction/drip behavior, and member discount APIs.wp-content/plugins/woocommerce-memberships/class-wc-memberships.phpwp-content/plugins/woocommerce-memberships/src/Abilities/Provider.phpwp-content/plugins/woocommerce-memberships/src/Plans/Abilities/wp-content/plugins/woocommerce-memberships/src/UserMemberships/Abilities/wp-content/plugins/woocommerce-memberships/src/Posts/Abilities/wp-content/plugins/woocommerce-memberships/src/Posts/Actions/SetPostRules.phpwp-content/plugins/woocommerce-memberships/src/Posts/Adapters/JsonSerializers/PostRestrictionRulesSerializer.phpwp-content/plugins/woocommerce-memberships/src/Posts/Traits/CanCheckRestrictablePostPermissionTrait.phpwp-content/plugins/woocommerce-memberships/src/Blocks/BlockEditorSidebar.phpwp-content/plugins/woocommerce-memberships/vendor/skyverge/wc-plugin-framework/woocommerce/Abilities/